API ReferenceManagementUsers
POST
/v1/mgmt/user/update

Authorization

Descope Project ID and Management Key
AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

loginId?string
Length1 <= length
email?string
phone?string
verifiedEmail?boolean
verifiedPhone?boolean
name?string
Lengthlength <= 254
roleNames?array<string>
string
userTenants?array<managementv1.AssociatedTenant>
customAttributes?object

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Example{ "attribute-key": "attribute-value" }
picture?string
additionalIdentifiers?array<string>
string
givenName?string
Lengthlength <= 254
middleName?string
Lengthlength <= 254
familyName?string
Lengthlength <= 254
ssoAppIds?array<string>
string
status?string
recoveryEmail?string
recoveryPhone?string
verifiedRecoveryEmail?boolean
verifiedRecoveryPhone?boolean
familyAssociations?array<AssociatedFamily>

each AssociatedFamily carries its own roleNames and familyScopedAttributes

sessionClassification?string

The session classification to assign the user to, by name. Omit the field to leave the current assignment untouched, send an empty string to remove it, and send a name to assign that classification. A name that does not match an existing classification is rejected.

Lengthlength <= 100

Updates a user's details, using a valid management key.

This API endpoint will update a user's details of a user utilizing a valid management key.

It is important to understand the update will take the configurations for the user provided and will overwrite all user settings. This means that if the user currently has email and phone, but the update only includes email, the phone and other non-provided configurations will be removed.

This API endpoint will remove any details that are not provided. It is preferred to use other updates supported by the API, such as the following options:

Additionally, you can update a user with multiple login IDs by passing an array of loginIds in string format within the additionalIdentifiers key.

It is suggested to gather the current user configurations via Load User in order to assist you in building the payload for this api endpoint.

See also

curl -X POST "https://api.descope.com/v1/mgmt/user/update" \  -H "Content-Type: application/json" \  -d '{}'
{  "user": {    "loginIds": [      "string"    ],    "userId": "string",    "name": "string",    "email": "string",    "phone": "string",    "verifiedEmail": true,    "verifiedPhone": true,    "roleNames": [      "string"    ],    "userTenants": [      {        "tenantId": "string",        "roleNames": [          "string"        ],        "tenantName": "string",        "permissions": [          "string"        ],        "roleIds": [          "string"        ]      }    ],    "status": "string",    "externalIds": [      "string"    ],    "picture": "string",    "test": false,    "customAttributes": {      "attribute-key": "attribute-value"    },    "createdTime": 0,    "TOTP": false,    "SAML": false,    "OAuth": {      "property1": false,      "property2": false    },    "webauthn": true,    "password": true,    "ssoAppIds": [      "string"    ],    "givenName": "string",    "middleName": "string",    "familyName": "string",    "editable": true,    "SCIM": true,    "push": true,    "permissions": [      "string"    ],    "OIDC": true,    "consentExpiration": 0,    "recoveryEmail": "string",    "verifiedRecoveryEmail": true,    "recoveryPhone": "string",    "verifiedRecoveryPhone": true,    "modifiedTime": 0,    "roleIds": [      "string"    ],    "recoveryCodes": true,    "dependent": true,    "userFamilies": [      {        "familyId": "string",        "roleNames": [          "string"        ],        "permissions": [          "string"        ],        "familyScopedAttributes": {}      }    ],    "lockReason": "string",    "tempLockExpiration": 0,    "scimTenantId": "string",    "samlTenantId": "string",    "oidcTenantId": "string",    "consentTenantId": "string",    "lastLoginTime": 0  },  "created": true}
export interface Response {user?: {loginIds?: string[]userId?: stringname?: stringemail?: stringphone?: stringverifiedEmail?: booleanverifiedPhone?: booleanroleNames?: string[]userTenants?: UserTenants[]status?: stringexternalIds?: string[]picture?: stringtest?: boolean/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}createdTime?: numberTOTP?: booleanSAML?: booleanOAuth?: {[k: string]: boolean}webauthn?: booleanpassword?: booleanssoAppIds?: string[]givenName?: stringmiddleName?: stringfamilyName?: stringeditable?: booleanSCIM?: booleanpush?: booleanpermissions?: string[]OIDC?: booleanconsentExpiration?: numberrecoveryEmail?: stringverifiedRecoveryEmail?: booleanrecoveryPhone?: stringverifiedRecoveryPhone?: booleanmodifiedTime?: number/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match *  roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]/** * whether the user has set up recovery codes */recoveryCodes?: booleandependent?: booleanuserFamilies?: UserFamilies[]lockReason?: stringtempLockExpiration?: number/** * scimTenantId is the tenant whose SCIM connection provisioned the user, empty when none or ambiguous. */scimTenantId?: string/** * samlTenantId is the tenant whose SAML SSO created the user or merged the user's login into it, empty when none or ambiguous. */samlTenantId?: string/** * oidcTenantId is the tenant whose OIDC SSO created the user or merged the user's login into it, empty when none or ambiguous. */oidcTenantId?: stringconsentTenantId?: string/** * lastLoginTime is the epoch time (in seconds) of the last time this user authenticated, 0 when the user has never logged in. *  On a response that completes a sign-in - a flow, an OTP or password verification, an SSO exchange - this is the sign-in BEFORE *  the current one, and it is 0 for a user signing in for the first time: the sign-in in progress is recorded after the response is *  produced. Read the user again through Load User or My Details to get the sign-in that just completed. */lastLoginTime?: number}created?: boolean}export interface UserTenants {tenantId?: stringroleNames?: string[]tenantName?: stringpermissions?: string[]/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match *  roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]}export interface UserFamilies {familyId?: stringroleNames?: string[]permissions?: string[]familyScopedAttributes?: {}}
Was this helpful?

Patch User PATCH

### Patch a user's details, using a valid management key. This API endpoint will patch a user's details of a user utilizing a valid management key. Additionally, you can patch a user with multiple login IDs by passing an array of loginIds in string format within the `additionalIdentifiers` key. This allows you to add additional login identifiers to an existing user without performing a full user update. <Callout title="Important" type="warn"> When adding additional identifiers to a user who has an SSO login ID, the user may be able to authenticate outside of SSO whenever SSO is not enforced and non-SSO methods (such as magic link or password) are available. See [Risks in Merging SSO and Non-SSO Identities](/sso/merging-sso-identities-risk) before using this field on SSO users. </Callout> ### See also - See [Manage Users](/manage/users) for further details on managing users. - See [The User Object](/api/overview#the-user-object) for further details on the user object.

Update User Status POST

### Updates an existing user's status, using a valid management key. This API endpoint allows you to update the user's status granularly without updating all user details. Available statuses to utilize: - invited - enabled - disabled The response returns the user's details in json format. ### See also - See [Manage Users](/manage/users) for further details on managing users. - See [The User Object](/api/overview#the-user-object) for further details on the user object.